Computer Program Product and Computer System for Controlling Performance of Operations within a Data Processing System or Networks

• US 20080208935A1
• Filed: 05/06/2008
• Published: 08/28/2008
• Est. Priority Date: 12/12/2003
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Aswathanarayana, Tejasvi, Palliyil, Sudarshan, Venkateshamurthy, Shivakumara
• Granted Patent: US 7,689,835 B2
• Time in Patent Office: Days
• US Class Current: 707/204
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Provided are methods, apparatus and computer programs for identifying matching resources (data files and executable files) within a data processing network, by comparison of hash values computed for each of a set of resources. A match between a newly computed hash value and a previously computed hash value for a resource indicates that the resource has not changed since the previous computation. A match between hash values for different resources indicates that they are identical. The result of the comparison can be used to determine whether a virus scan is currently required for a resource, on the basis that a resource which is unchanged since it was classified virus-free remains virus-free and a resource which is identical to a virus-scanned resource does not require duplication of the virus scan. The methods, apparatus and computer programs enable more efficient use of antivirus scanning or management of a backup copy process.

Claims

1-38. -38. (canceled)

39. A computer program product, stored on a tangible, computer readable medium, for controlling performance of operations in relation to a set of resources within a data processing network, the operations including a first operation, said computer program product having instructions for execution by a computer, which, when executed by the computer, cause the computer to implement a method comprising the steps of:

computing a set of hash values representing a set of resources for which an operation has been performed;

storing the set of hash values;

in response to a requirement for performance of the operation, computing a new set of hash values representing the set of resources;

comparing the new hash values with the stored hash values for the set of resources to identify matches between new hash values and stored hash values;

determining that performance of the operation is not currently required for resources for which a match is identified between the respective new hash value and a stored hash value;

performing the operation for resources for which no match is identified between the new hash value and any stored hash value;

wherein the step of computing a new set of hash values comprises;

reading the set of resources from a first storage medium of a system in the data processing network into a second storage medium of the system, the second storage medium providing faster access than the first storage medium, wherein the computing of the new set of hash values accesses the set of resources read to the second storage medium and the method further comprises;

comparing each resource of the set of resources with a maximum size limit to identify a subset of the resources, wherein each resource of the subset is smaller than said size limit; and

retaining said subset of resources within said second storage medium and

performing, for the subset of resources retained within said second storage medium, further operations on ones of the subset of resources, the further operations being selected from operations including;

making backup copies and transferring copies of the resources of the subset of resources to other systems.

40. The computer program product of claim 39, wherein the first operation comprises scanning the resources to identify computer viruses.

41. The computer program product of claim 39, wherein the first operation comprises making a backup copy of the resources.

42. The computer program product of claim 39, for controlling performance of virus scanning and backup copy operations in relation to a set of resources within a data processing network, the method comprising:

using said identification of a match between a respective new hash value and a stored hash value for a resource, resulting from a single comparison of new and stored hash values, to determine that neither virus scanning nor backup copy operations are currently required for the resource.

43. The computer program product of claim 39, wherein the first operation comprises transferring a resource across a low bandwidth communication channel.

44. The computer program product of claim 39, wherein the steps of computing hash values comprise:

applying a secure hash function to a bit pattern representing a resource, for each of a set of resources.

45. The computer program product of claim 44, wherein the set of resources for which hash values are computed for a data processing system comprises the set of all files of executable file types on the system.

46. The computer program product of claim 39, wherein the set of resources are distributed across a plurality of data processing systems within the network and the steps of storing the set of hash values and comparing the new hash values with the stored hash values are performed at a first data processing system within the network for the set of resources distributed across the plurality of data processing systems.

47. The computer program product of claim 46, wherein the steps of computing hash values for a resource are performed at a respective one of the plurality of data processing systems at which the resource is stored, the method further comprising sending the computed hash values to said first data processing system.

48. The computer program product of claim 46, further comprising the step of sending, to each data processing system storing a resource for which it is determined that performance of the first operation is not currently required, an indication that performance of the first operation is not currently required for the resource.

49. The computer program product of claim 46, wherein the step of performing the first operation is performed at the first data processing system and the result of performing the first operation is communicated to each of the plurality of data processing systems storing a resource for which the first operation is required.

50. The computer program product of claim 39, wherein at least one resource of the set of resources comprises a group of files and the step of computing a set of hash values comprises computing a single hash value for the group of files.

51. The computer program product of claim 50, wherein at least one resource of the set of resources is a compressed group of files.

52. A computer system, comprising:

a processor; and

a storage device connected to the processor, wherein the storage device has stored thereon a program for causing the processor to perform operations in relation to a set of resources within a data processing network, the operations including a first operation, and wherein the processor is operative to execute instructions of the program to implement a method comprising the steps of;

computing a set of hash values representing a set of resources for which an operation has been performed;

storing the set of hash values;

in response to a requirement for performance of the operation, computing a new set of hash values representing the set of resources;

comparing the new hash values with the stored hash values for the set of resources to identify matches between new hash values and stored hash values;

determining that performance of the operation is not currently required for resources for which a match is identified between the respective new hash value and a stored hash value;

performing the operation for resources for which no match is identified between the new hash value and any stored hash value;

wherein the step of computing a new set of hash values comprises;

reading the set of resources from a first storage medium of a system in the data processing network into a second storage medium of the system, the second storage medium providing faster access than the first storage medium, wherein the computing of the new set of hash values accesses the set of resources read to the second storage medium and the method further comprises;

comparing each resource of the set of resources with a maximum size limit to identify a subset of the resources, wherein each resource of the subset is smaller than said size limit; and

retaining said subset of resources within said second storage medium and

performing, for the subset of resources retained within said second storage medium, further operations on ones of the subset of resources, the further operations being selected from operations including;

making backup copies and transferring copies of the resources of the subset of resources to other systems.

53. The system of claim 52, wherein the first operation comprises scanning the resources to identify computer viruses.

54. The system of claim 52, wherein the first operation comprises making a backup copy of the resources.

55. The system of claim 52, for controlling performance of virus scanning and backup copy operations in relation to a set of resources within a data processing network, the method comprising:

using said identification of a match between a respective new hash value and a stored hash value for a resource, resulting from a single comparison of new and stored hash values, to determine that neither virus scanning nor backup copy operations are currently required for the resource.

56. The system of claim 52, wherein the first operation comprises transferring a resource across a low bandwidth communication channel.

57. The system of claim 52, wherein the steps of computing hash values comprise:

applying a secure hash function to a bit pattern representing a resource, for each of a set of resources.

58. The system of claim 57, wherein the set of resources for which hash values are computed for a data processing system comprises the set of all files of executable file types on the system.

59. The system of claim 52, wherein the set of resources are distributed across a plurality of data processing systems within the network and the steps of storing the set of hash values and comparing the new hash values with the stored hash values are performed at a first data processing system within the network for the set of resources distributed across the plurality of data processing systems.

60. The system of claim 57, wherein the steps of computing hash values for a resource are performed at a respective one of the plurality of data processing systems at which the resource is stored, the method further comprising sending the computed hash values to said first data processing system.

61. The system of claim 57, further comprising the step of sending, to each data processing system storing a resource for which it is determined that performance of the first operation is not currently required, an indication that performance of the first operation is not currently required for the resource.

62. The system of claim 57, wherein the step of performing the first operation is performed at the first data processing system and the result of performing the first operation is communicated to each of the plurality of data processing systems storing a resource for which the first operation is required.

63. The system of claim 52, wherein at least one resource of the set of resources comprises a group of files and the step of computing a set of hash values comprises computing a single hash value for the group of files.